It is a common trope of media lawyers that defamation claims have been on the wane since the Defamation Act 2013, and that data protection law might be the way to fill the gap. (We at Panopticon scorn such arriviste tendencies.) And in Warby J, there is a willing champion of alignment of legal principles between defamation and data protection. He particularly emphasised the read-across in the context of complaints of inaccurate data processing in NT1 v Google LLC [2018] EWHC 799 (QB) (see here) and he has done so again in his very interesting judgment in Aven v Orbis Business Intelligence Ltd [2020] EWHC 1812 (QB).

Of particular headline-grabbing attention – but below the ‘read more’ tab here because of more discerning clientele – about Aven was that it concerned aspects of the so-called ‘Trump Dossier’, prepared by former intelligence agent Christopher Steele and his firm (Orbis) at the behest of senior Democrats about the links between President Putin, Donald Trump and Russia generally. That dossier was subsequently leaked to Buzzfeed, which published it. Rather hidden amongst the more exciting reports of kompromat, prostitutes and activities requiring extensive hotel laundry services, were comments on the claimants, the ultimate owners of the Alfa Group, which includes the Alfa Bank. The details of the allegations in the Dossier are at [7], but the gist was that the Alfa Group did favours, including favours involving “illicit cash”, for President Putin.

The Dossier was, in respect of the claimants at least (no claim yet having been filed by President Trump), said to involve inaccurate processing personal data contrary to the fourth principle, and unfair and unlawful processing contrary to the first principle: it was a DPA 1998 claim. Orbis relied on both section 35(2) (legal purposes) and section 28(1) (national security) defences, generally said that the principles were not breached and denied any remedies were due.

The judgment is long and detailed, as well as being very fact-sensitive in many respects. But it has lots of useful things to say on lots of different bits of the DPA architecture.

First, Warby J repeated his approach in NT1 that to work out whether something was personal data or not, one needed to view the article or extract in which it appeared as a whole, and not an item-by-item approach. The Dossier gave a narrative, and it had to be read as one, so as to avoid frustrating the rights afforded by the DPA. As a result, the Dossier did allege that the claimants personally, and not just the company, did do significant favours for President Putin (and vice versa) and this was their personal data. References to carrying “illicit cash” were allegations processing sensitive personal data, because it was an allegation of criminal offences and would be so interpreted by any ordinary reader.

Second, Warby J reiterated the now established propositions that if Mr Steele orally told a third party about the contents of the Dossier that did not amount to processing of personal data, and that the publication of the leaked Dossier by Buzzfeed (and indeed the leaking by third parties) were not acts of processing for which Orbis was the controller.

Third, the application of the legal purposes exemption in section 35(2) was particularly convoluted, not least because (as is oft forgotten) it is not a blanket exemption but only relevant to non-disclosure provisions and only where necessary. There are some useful basic principles at [66], but sufficiently basic that most readers of this blog will already know them. On the facts, Warby J concluded that he was sufficiently satisfied that the Dossier was commissioned for the purpose of giving legal advice, not least because it was commissioned by a law firm. Importantly, it is not necessary that the controller (Orbis) is the person contemplating proceedings or needing advice; if a lawyer obtains information with the aim of using it for the purpose of formulating legal advice to a client on a matter within the scope of the lawyer’s instructions, the disclosure of that information to the lawyer is made for the purpose of obtaining such advice. Moreover, it is sufficient that the legal purpose is one of the purposes, even if it is not the only one. The concept of “establishing legal rights” in section 35(2) is a broad one, encompassing investigations to establish whether such rights exist. That provided a context in which to conclude on fairly broad terms that the Dossier was necessary in the relevant sense.

However, whether section 35(2) assists the controller depends on whether compliance with the principles would be inconsistent with the legal purposes processing. That may be the case for some but not all. Warby J held that the notice requirements (see now Articles 13/14 GDPR) were inconsistent, but that it would not be inconsistent to apply the requirements of section 14 on rectification. He accepted that it would be inconsistent to require an absolute standard of accuracy in the context, but not that it would be inconsistent to require accurate processing read with the reasonable steps defence in paragraph 7 of Part II of Schedule 1 to the DPA 1998. Accordingly, liability could not be avoided for inaccurate processing for which reasonable steps to ensure its accuracy had not been taken by reliance on section 35(2).

Fourth, the national security exemption in section 28 was available to Orbis and any controller. There was some close analysis of the statutory language – not much seen in litigation – and Warby J construed the use of “required” as imposing an exacting test. Ultimately, he accepted that Orbis was entitled to rely on section 28 as excluding the notice requirements of the DPA on national security grounds, when disclosures were being made both to UK intelligence and also US bodies and persons too, given the clear link between US and UK security interests. However, Warby J rejected that it was required that the fourth principle be disapplied, or that the first principle’s requirements more generally be disapplied. Disclosing with a view to national security is not sufficient to show that an exemption was required.

Fifth, the longest (and for the claimants most significant) section of the judgment concerned whether the data in the Dossier concerning the claimants was accurate. In this aspect, there was quite strong whiff of a defamation trial. Warby J applied across defamation principles to discern between facts and opinions on the basis that they reflected the experience of generations. There was reference to Chase levels of meaning. There was also extensive cross-examination, which ultimately failed to undermine the claimants’ case of inaccuracy. Those interested in the details of the relationships between Alfa and Putin can read the judgment. Mr Steele faced questions about the standard of care he had taken in producing the Dossier, and whether he took reasonable steps within the meaning of paragraph 7 of Part II of Schedule 1 to the DPA 1998. Warby J held he had not in relation to the allegation of moving “illicit cash”, which was a serious allegation and had not been sufficiently checked beyond reliance on a single source. However, in the relation to the other aspects of the data, it was accepted that it was reasonable in the context of this Dossier and what it was to be used for that Orbis had taken reasonable steps; the contextual nature of the exercise is important. The Dossier contained quite general, credible and not especially significant allegations (save for the “illicit cash” one), was provided for legal advice purposes, was disclosed by Orbis only to a small number of others and then for national security purposes. If accuracy trials become a new bonanza, this will be an important defence.

Sixth, the question then arose as to what remedy or remedies to be awarded. Orbis had already recorded the claimants’ dispute as to the accuracy of the information in its records, and the Judge was prepared to order that the Dossier be marked up by reference to the judgment. But he held that it was unreal to demand notification by Orbis to those to whom disclosure had been made, given that the numbers of people were small and, the Judge thought, highly likely to be aware of the judgment in any event. So no further order under section 14. No declaration was necessary (again in part by reference to the absence of such a remedy in libel trials).

However, much attention will be given to the award of £18,000 in damages to the first and second claimants for the inaccurate processing of the “illicit cash” allegation. It has to be said that this is one of the less satisfactory bits of the judgment, coming nearly 200 paragraphs in. Perhaps unsurprisingly, no-one seriously suggested much by way of damage in the usual sense of distress. Instead, the claimants said the damage was reputational harm. Orbis conceded this was recoverable in principle, and Warby J agreed with some (and surely justified) indication of caution. As a result, Warby J applied the common law approach to damages in defamation, to prevent “incoherence in the law”. The principles, he held, were summarised in Barron v Vines [2016] EWHC 1226 (QB). But don’t look there for guidance on quantum; you won’t find it. Defamation case law also answered whether or not, and how, one could properly challenge the idea of the claimants’ reputation which was being remedied. The Judge awarded £18,000.

There are a number of aspects of the compensation award which are problematic, leaving aside the total absence of any reasons given as to why that sum was alighted on and not, say, £10,000 or £25,000. It may align with defamation, but it is not easy to follow to the reader. But is running the fourth data protection principle into a defamation trial – without any of the hurdles or protections afforded by the Defamation Act, particularly jurisdictional given the broad application of the GDPR – really what was intended? It might be thought unlikely. And it might be thought even more odd that awards of damages are significantly higher for putative loss to reputation than have been recovered for even the most serious forms of distress. Does that mean distress damages are too low, or that defamation read-across out of kilter? The Trump Dossier was possibly not the facts to deal with all of these points, but some of them will need dealing with sooner or later.

Robin Hopkins acted for Orbis.

Christopher Knight